CVE-2026-93341 MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingsendrefund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers...

EUVD-2026-84396

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingsendrefund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers...

CVE-2026-93341

The MarketKing plugin for WordPress (a multi-vendor marketplace for WooCommerce) versions before 2.1.72 contain a missing authorization vulnerability in the marketking_send_refund AJAX action. Authenticated users with subscriber-level access or higher can supply an arbitrary order ID to create fr...

CVE-2026-93341 MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingsendrefund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers...

CVE-2026-95674 MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

EUVD-2026-84392

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

BIT-NIFI-2026-86089 Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

BIT-NIFI-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

BIT-NIFI-2026-81866 Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret...

CVE-2026-4123

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2025-14486

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

WordPress The Welcomizer plugin <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Remote Code Execution vulnerability discovered by Nabil Irawan in WordPress Plugin The Welcomizer versions = 2.8.1...